MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
modx modx revolution 2.7.0
modx modx revolution